Ghidra by NSA (github.com)

Article summary

Ghidra is a software reverse engineering framework created and maintained by the National Security Agency Research Directorate. It includes a suite of tools for analyzing compiled code on various platforms, including Windows, macOS, and Linux. Ghidra supports a wide range of processor instruction sets and executable formats, and can be run in both user-interactive and automated modes. The framework is open-source and available on GitHub.

Main themes

• Software Reverse Engineering
• Ghidra Framework
• NSA Research Directorate
• Code Analysis Tools
• Open-Source Software

What commenters say

• Ghidra is a powerful tool for reverse engineering, but its user interface and font size can be improved.
• Some users prefer IDA over Ghidra for mainstream security and malware research, while others prefer Ghidra for its support of exotic architectures.
• The use of cracked IDA is common among hobbyist reverse engineers, while Ghidra is not as widely recommended for serious work.
• Ghidra's extensibility and plugin architecture make it a valuable tool for reverse engineering, and its open-source nature allows for community contributions and customization.
• The NSA likely uses Ghidra with custom plugins and tools that are not publicly available, which could provide additional capabilities and functionality.
• Ghidra's decompiler and analysis capabilities have improved significantly, making it a more viable option for reverse engineering, especially for languages like Rust.
• The choice between Ghidra and IDA ultimately depends on the specific needs and goals of the user, with Ghidra offering more flexibility and customization options, and IDA providing more accurate analysis and a user-friendly interface.
• Some users are skeptical about the existence of a more capable internal version of Ghidra, while others believe that the NSA may have access to more advanced tools and plugins that are not publicly available.